In the CSV, add the hco.kubevirt.io/allow-access-cluster-services, and the hco.kubevirt.io/allow-prometheus-access labels to the virt-operator pods.

The first one ensures network access to the api-server and the DNS, and the 2nd label ensures Prometheus access to the pod.